2026-07-24

2026-07-24 Friday - Book Review: Software Security for Developers

[My LinkedIn companion post]

[image source: Amazon]



Book: Software Security for Developers: With Examples in Java and Spring

Publisher: Manning 

Publication Date: June 9, 2026

Authors: 

Adib Saikali
Distinguished Software Engineer @ Tanzu
Toronto, Ontario, Canada
https://www.linkedin.com/in/adibsaikali/

Laurentiu Spilca 
Principal Development Consultant, Endava
Bucharest, Romania
https://www.linkedin.com/in/laurspilca/?locale=en 

 

Review Rating:  4-Stars

Review Title: A good book for an introduction to Software Security - for both Developers and Managers 

[Link to my Amazon Review]

====================================================================== 

I enjoyed reading this book. It is well-written, and provides a broad survey of important software security concepts and techniques – with easy to understand illustrations, descriptions, and code examples. 

The companion GitHub repository provides 27 subfolders with Java & Spring examples.


Chapters 2-17 include a number of exercises (182), and at the end of the chapter there is a consistent approach in providing Exercise answers – as well as a Summary. The summary bullets are meaningful, and well written. 

If the reader leverages the contents of each chapter, including the exercises, and the code examples – then this book will provide the diligent reader with a very HANDS-ON learning experience.


Some minor nits:

The naming convention of the folders in the companion GitHub repository for the book would have been better named using a consistent 2-character identifier for the chapter, and a 2-character identifier for the exercise - so that a natural sort order would be enforced.

"Single-sign on" is improperly written, it should be "Single sign-on"
page-v
page-211 
page-335


While the writing is crisp & concise, and the coverage of the subject matter is *mostly* sufficient for a book of this length – there are three notable deficiencies:

1. The book suffers from a paucity of coverage for the very important topic of Post Quantum Cryptography (PQC).

Although the book was published in June 2026, there are only two pages (53, 75) that vaguely refer to NIST cryptographic algorithms standards – and neither of those mention the NIST work on Post Quantum Cryptography (PQC). Nor are there any "additional reading" suggestions. 

Further, on Page-94, this statement is made:
"Cryptographers are building encryption algorithms that can resist quantum computers, but none has been standardized so far."
- This is incorrect. 


On August 13, 2024, NIST released final versions of the first three Post Quantum Crypto Standards: FIPS 203, FIPS 204, and FIPS 205. [see NIST press release]

✅ Federal Information Processing Standard (FIPS) 203, intended as the primary standard for general encryption. Among its advantages are comparatively small encryption keys that two parties can exchange easily, as well as its speed of operation. The standard is based on the CRYSTALS-Kyber algorithm, which has been renamed ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism. 

✅ FIPS 204, intended as the primary standard for protecting digital signatures. The standard uses the CRYSTALS-Dilithium algorithm, which has been renamed ML-DSA, short for Module-Lattice-Based Digital Signature Algorithm. 

✅ FIPS 205, also designed for digital signatures. The standard employs the SPHINCS+ algorithm, which has been renamed SLH-DSA, short for Stateless Hash-Based Digital Signature Algorithm. The standard is based on a different math approach than ML-DSA, and it is intended as a backup method in case ML-DSA proves vulnerable. 

On March 11, 2025 NIST released Hamming Quasi-Cyclic (HQC) as the fifth algorithm for post-quantum asymmetric encryption as used for key encapsulation / exchange.The new algorithm is as a backup for ML-KEM, the main algorithm for general encryption.

Additionally, there are international alternatives to the NIST standard, that could have been briefly cited, and links provided. For example, see this Akamai article, 'A Guide to International Post-Quantum Cryptography Standards', published on Oct 08, 2025.


2. The book suffers from an absence of "further reading" suggestions for the important topic of Zero Trust. 


3. The book does not mention Homomorphic Encryption. 
 

====================================================================== 

 

Note: 2026-07-26 Sunday: I will probably add another 10-20, or 30 links here, before I am finished. 

These are just some of the suggested additional reading resources such a book could have included:
(illustrative, not exhaustive)

Status: Work-In-Progress 

Suggested sites for further reading:  

 
Java Security: 
 
Spring Security:  

 

 Interesting Security-related web sites: 

 


Interesting Security-related GitHub Resources:  

 

Homomorphic Encryption (HE) / Fully Homomorphic Encryption (FHE): 
  • Suggested Background Reading: 
    • https://en.wikipedia.org/wiki/Homomorphic_encryption 
      • "Homomorphic encryption is a form of encryption that allows computations to be performed on encrypted data without first having to decrypt it. The resulting computations are left in an encrypted form which, when decrypted, result in an output that is identical to that of the operations performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. This allows data to be encrypted and outsourced to commercial cloud environments for processing, all while encrypted."
      • Note table: "Implementations" 
    • https://en.wikipedia.org/wiki/Paillier_cryptosystem 
      • "The Paillier cryptosystem, invented by and named after Pascal Paillier in 1999, is a probabilistic asymmetric algorithm for public key cryptography. The problem of computing n-th residue classes is believed to be computationally difficult. The decisional composite residuosity assumption is the intractability hypothesis upon which this cryptosystem is based."

 

 

 

  • Papers:
    • OpenFHE: Open-Source Fully Homomorphic Encryption Library
      • https://eprint.iacr.org/2022/915 
        • "Fully Homomorphic Encryption (FHE) is a powerful cryptographic primitive that enables performing computations over encrypted data without having access to the secret key. We introduce OpenFHE, a new open-source FHE software library that incorporates selected design ideas from prior FHE projects, such as PALISADE, HElib, and HEAAN, and includes several new design concepts and ideas. The main new design features can be summarized as follows: (1) we assume from the very beginning that all implemented FHE schemes will support bootstrapping and scheme switching; (2) OpenFHE supports multiple hardware acceleration backends using a standard Hardware Abstraction Layer (HAL); (3) OpenFHE includes both user-friendly modes, where all maintenance operations, such as modulus switching, key switching, and bootstrapping, are automatically invoked by the library, and compiler-friendly modes, where an external compiler makes these decisions. This paper focuses on high-level description of OpenFHE design, and the reader is pointed to external OpenFHE references for a more detailed/technical description of the software library."
      • [Also see 'openfhe-development' GitHub Repo citation below, under 'GitHub Resources']

 

 

    • SoK: New Insights into Fully Homomorphic Encryption Libraries
      via Standardized Benchmarks (2022)
      • https://eprint.iacr.org/2022/425.pdf 
      • "Fully homomorphic encryption (FHE) enables arbitrary computation on encrypted data, allowing users to upload ciphertexts to cloud servers for computation while mitigating privacy risks. Many cryptographic schemes fall under the umbrella of FHE, and each scheme has several open-source implementations with its own strengths and weaknesses. Nevertheless, developers have no straightforward way to choose which FHE scheme and implementation is best suited for their application needs, especially considering that each scheme offers different security, performance, and usability guarantees. To allow programmers to effectively utilize the power of FHE, we employ a series of benchmarks called the Terminator 2 Benchmark Suite and present new insights gained from running these algorithms with a variety of FHE back-ends. Contrary to generic benchmarks that do not take into consideration the inherent challenges of encrypted computation, our methodology is tailored to the secure computational primitives of each target FHE implementation. To ensure fair comparisons, we developed a versatile compiler (called T2 ) that converts arbitrary benchmarks written in a domain-specific language into
        identical encrypted programs running on different popular FHE libraries as a backend. Our analysis exposes for the first time the advantages and disadvantages of each FHE library as well as the types of applications most suited for each computational domain (i.e., binary, integer, and floating-point).        "
      • "This work was partially supported by the University of Delaware Research Foundation Grant 21A01012 and
        the Electrical and Computer Engineering department at the University of Delaware.        "

 

 

  • GitHub Resources:
    • GitHub Repo: Awesome - A curated list of amazing Homomorphic Encryption libraries, software and resources

 

    • GitHub Repo: mpc4j
      • https://github.com/alibaba-edu/mpc4j 
      • "Multi-Party Computation for Java (mpc4j) is an efficient and easy-to-use Secure Multi-Party Computation (MPC), Homomorphic Encryption (HE), and Differential Privacy (DP) library mainly written in Java."
      • Language: Java
      • License: Apache 2.0
      • Status: Appears to be active (recent updates in 2026) 

 

 

    • GitHub Repo: Ciphercraft
      • https://github.com/ADWISE-VCU/Ciphercraft 
      • "Contains Packages for ElGamal, Paillier, Goldweiser-Micali and DGK Homomorphic Encryption System. Also implements secure multiplication, division and comparison." 
      • Language: Java 
      • License: MIT 
      • Status: (last updated ~2025) 

 

    • GitHub Repo: fhe-core
      • https://github.com/kryptnostic/fhe-core 
      • Language: Java, Wolfram Language 
      • License: Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Public 
      • Status: DEPRECATED (see krypto)

 

 

  • Spring Security support for Homomorphic Encryption (HE): 

 

 Suggested links for relevant IETF RFCs:

 

 

 

 

 

 

 

 

Suggested software development (security-related) books for further reading:   

(Note: I will be citing books published by Manning, O'Reilly, and Packt - as well as some others)

 

 

 Post-Quantum Cryptography (PQC) links for further reading: 

  

  • Regulatory Forces:

 

  
  • Spring Security support for Post Quantum Cryptography (PQC):  
  • Enhancement: NimbusJwtEncoder does not support Edwards Curve signature (EdDSA) family algorithms. #17098


National Institute of Standards and Technology (NIST) Cryptographic links for further reading:  

  • Use of Cryptographic Modules by Federal Agencies and Departments
    • https://csrc.nist.gov/projects/cryptographic-module-validation-program
      • "FIPS 140-2 and FIPS 140-3 requirements are applicable to all U.S. Federal agencies. Agencies must use cryptographic-based security systems to provide adequate information security for all operations and assets as defined in 15 U.S.C. § 278g-3."
      • "Non-validated cryptography is viewed as providing no protection to the information or data—in effect the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2 or FIPS 140-3 is applicable. In essence, if cryptography is required, then it must be validated. Should the cryptographic module be revoked, use of that module is no longer permitted."

 

Posted by No comments:
Labels: , , ,
Subscribe to: Posts (Atom)

WordCount

Copyright

© 2001-2026 International Technology Ventures, Inc., All Rights Reserved.